Month: November 2016

Dr. Barbara Simons about Internet voting on As It Happens

Carol Off interviewed Barbara Simons on CBC Radio’s As It Happens on November 24, 2016. The segment is about the US recount, but Dr. Simons is asked about Canada:

Carol Off: What concerns should the Canadian government have [about switching to computer/internet based voting]?

Barbara Simons: First of all, the notion that internet voting increases the number of people who vote is not true. The increase is small. It doesn’t even increase participation by young people. On top of that, if you want to have the elections hacked in Canada, the best thing to do is have internet voting — because that makes it really easy to hack them, anywhere. And a nation state has enormous power to do that.

The full transcript is available, scroll to segment “Election Recount”.

For more about Barbara Simons see my list of computer science experts

https://papervotecanada2.wordpress.com/2016/11/19/internet-voting-and-computer-security-expertise/#BarbaraSimons

Previously:
October 2, 2016  ERRE Presentation – Internet Voting: Making Elections Hackable – Dr. Barbara Simons

Province of Nova Scotia Internet voting

(This post is about provincial-level voting, not the municipal elections covered in the Municipal Elections Act.)

The Election Commission of Nova Scotia examined Internet voting in 2013. Their report is available within Elections Nova Scotia: Annual Report of the Chief Electoral Officer April 1, 2012 – March 31, 2013 (PDF) – specifically pp. 14-16 Appendix I: Internet and Telephone Voting in Nova Scotia.

They find:

After considering the literature available, including a careful review of Elections BC’s Discussion Paper on Internet Voting3, the Commission members developed a unanimous position that it is premature to entertain either Internet based or telephone voting options at this time.

3Elections BC – Discussion Paper: Internet Voting (PDF) – August 2011

The NS Commission identified the following questions:

  1. How secure are Internet and telephone-based voting transactions?
  2. Can service availability be guaranteed?
  3. How do you know it is me voting?

Experts warn that currently no transaction using the Internet can be guaranteed to be secure. Despite advances in security, there is still the chance a voter’s identity and voting choice could be exposed, or that someone could vote with someone else’s credentials.
The possibility of collecting family members’ PINs and then voting on their behalf increases significantly in the privacy of one’s own home. At their very best, lists of electors rarely surpass a 95 percent coverage and accuracy level. Under Internet or telephone voting arrangements, the chance of being caught voting on behalf of someone else is minimal.

    1. Is there an audit trail I can follow?

In the existing traditional paper based voting system, …. A record exists of how many people voted and identity information (but not how they voted) exists about each person who cast a ballot at an assigned ballot box. That is the “before state.” Ballots can then be physically verified and recounted by a provincial court judge. The number of ballots counted must correspond exactly to the recorded number of people who voted at that polling station.
Perhaps the largest leap of faith with Internet and telephone voting is the fact that there is no “before state” examinable. While an auditor can easily demonstrate that the number of votes cast equals the number of votes counted, there remains considerable debate whether there is a satisfactory and transparent way to compare how many of those votes were actually cast by electors verified as registered and not having voted before, and whether each vote was accurately recorded by the software used.

  1. Can I watch the count?

The traditional method of voting achieves transparency by having the acts of voting and counting take place in controlled physical locations, where observers representing all interested parties can witness the process and ensure that all required procedures are properly followed.
Technology encases the voting and counting process in a “black box,” which reduces transparency and, potentially, public confidence. …
In addition to the known insecurities, a provincial general election conducted on an Internet platform for web or telephone voting could elicit new levels of unknown threats from hackers seeking to gain a high profile from a successful attack. Consider also that the most serious attacks would likely come from persons or groups motivated to change the outcome without anyone noticing.
With that in mind, the adversaries of an election system would not likely be amateurs n basements but interested groups and individuals with a significant stake in the outcome of an election.

And finally to quote from their Conclusion

Until credible answers to [the questions above] are available, and until functioning, transparent Internet and telephone voting systems have been demonstrated and proven, extreme caution and prudence is required.

Brief submitted to New Brunswick Commission on Electoral Reform – November 2016

I have submitted my brief to the commission, it’s a 16-page document with 31 references cited.

You can find the PDF at

https://drive.google.com/open?id=0B1dTIjUvkfsDbU1pTS1CSXJHTzBuUVpjMXhHS3JUcEp4ZHdB

where you can download by clicking on the down arrow in the upper right of the screen.

Or you can see the embedded version below. NOTE: Due to an quirk of Google, the page numbering in the embedded doc below is off by one. The table of contents has the right numbers, but the bottom right numbering is off by one; page 2 should be page 1.

UPDATE 2017-01-28: The link to the Kitchener report in my document is incorrect, it should be

Gosse, R. (2012, December 10). FCS-12-191 – Alternate Voting – Internet Voting. Retrieved from City of Kitchener – Laserfiche WebLink: https://lf.kitchener.ca/WebLinkExt/DocView.aspx?id=1235356&dbid=0

Previously:
November 20, 2016 New Brunswick electoral reform consultation including Internet voting
October 6, 2016 Brief submitted to [Federal] Special Committee on Electoral Reform – October 2016

Province of Ontario Internet voting

(This post is about provincial-level voting, not the municipal elections covered in the Municipal Elections Act.)

Ontario examined provincial online voting from fall 2010 to fall 2012, with the resulting three years of investigation being published as a report on “alternative voting technologies” in June 2013.  The report is in two parts, consisting of the main report and a separate Appendix 5 which is a 231-page business case about online voting.

The report is currently available on the Elections Ontario page Reports and Publications, under Recommendations Other publications and documentation

The report concludes that Internet voting, which it calls “network voting”, is not ready for use because it does not meet the necessary requirements and needed level of integrity.

Elections need to be administered with proven, well-tested, and secure processes. Innovations must be tested in a methodical and principled manner, so that the benefits and risks of the innovation can be objectively assessed, without endangering the trust that electors have in the integrity of the process and the validity of the results.

…

At this point, we do not have a viable method of network voting that meets our criteria and protects the integrity of the electoral process.

The report sets out very clear requirements that a voting system needs to meet

Our implementation criteria are:

  • Accessibility:
    The voting process is equally accessible to all eligible voters, including voters with disabilities. The voting process will be performed by the voter without requiring any assistance for making their selections.
  • Individual verifiability:
    The voting process will provide means for the voter to verify that their vote has been properly deposited inside the virtual ballot box.
  • One vote per voter:
    Only one vote per voter is counted for obtaining the election results. This will be fulfilled even in the case where the voter is allowed to cast their vote on multiple occasions (in some systems, people can cast their vote multiple times, with only the last one being counted).
  • Voter authentication and authorization:
    The electoral process will ensure that before allowing a voter to cast a vote, that the identity of the voter is the same as claimed, and that the elector is eligible to vote.
  • Only count votes from valid voters:
    The electoral process shall ensure that the votes used in the counting process are the ones cast by valid eligible voters.
  • Voter privacy:
    The voting process will prevent at any stage of the election the ability to connect a voter and the ballots cast by the voter.
  • Results validation:
    The voting process will provide means for verifying if the results clearly represent the intention of the voters that participated in the voting process.
  • Service availability:
    The election process and any of its critical components (e.g., voters list information, cast votes, voting channel, etc.) will be available as required to voters, election managers, observers or any other actor involved in the process.

This language calls to mind the requirements in the Computer Technologists’ Statement on Internet Voting.

The report identifies a number of risks that are specific to Internet voting, including digital authentication, digital denial of service, and lack of transparency.

When developing our implementation criteria, we ensured that they addressed the following risks and limitations:

  • Security concerns – security breaches that could jeopardize the integrity of the voting process.vi
  • Secure digital authentication mechanisms are not available.vii
  • The possibility of denial of service – whether deliberate or inadvertent.viii
  • Lack of transparency, including for a vote audit or for recount purposes, due to the lack of a paper trail.
  • The digital divide – some electors or subgroups of electors do not have equal access to the internet.
  • Network voting is costly – particularly when supplementing existing voting channels.ix

The end notes are
viFor example, Vaughan, Huntsville, Edmonton. Edmonton recently completed a trial implementation of internet voting, where electors were invited to vote online for their favourite colour of jellybean. On the basis of this trial, a citizen panel recommended to city council that they proceed with plans for internet voting in the upcoming election for the city of Edmonton. However, the city council rejected this recommendation, citing concerns regarding security.
viiFor example, Vaughan; concerns raised by McAfee
viiiVaughan and others citing the denial-of-service experience faced by the NDP during its 2012 leadership election.
ixFor example, Vaughan; U.S. military

See the references mentioned in the end notes below in the copy of Appendix 3: Selected Works Consulted.

The report continues by examining the use of Internet voting in Ontario municipalities.

In 2010, 44 of 444 Ontario municipalities offered network voting for their municipal elections.

Turnout does not increase when online voting is offered.

The academic literature supports Markham’s experience in suggesting that there are inconclusive results about the impact of network voting on voter turnout. Voter turnout is influenced by a number of factors, many which are difficult to quantify. These include, for example, the competitiveness of the election, candidate campaign mobilization efforts, issues at stake, voter fatigue, and the weather, among other elements that may vary from one election to the next in the same jurisdiction.

The technology, introduced with claims of efficiency, sometimes actually introduces delays and increases risk.

…a total of 33 municipalities experienced system delays on election day when servers became overloaded due to hardware problems and higher-than-expected levels of access by election candidates. Electors were delayed in casting their votes during this time. In some cases, voting hours were extended by an hour in order to compensate for the lost time; at least one municipality extended voting for a full day.

…

The hardware server error experienced by the vendor raises concerns regarding reliance on vendors to provide critical election related services such as election results accumulation and tabulation. An overreliance on vendors and technology can heighten risks to the electoral process if appropriate mitigation strategies are not in place.

When Ontario examined the municipal experience and compared the technology available with the requirements (listed earlier), they concluded

If we return to public expectations that a network voting solution would be more convenient, just as secure and less cumbersome than our current processes, the experiences of many Ontario municipalities indicate that the benefits of network voting may not be as great as predicted.

The report then looks at Nova Scotia

In 2008, four municipalities in Nova Scotia offered internet voting in their municipal elections. By 2012, that number had grown, and 15 municipalities offered internet voting.

and at Alberta

After the City of Edmonton withdrew its support in February 2013, Alberta withdrew its funding for other internet voting pilots and decided not to proceed with a regulatory change that would have permitted pilots in municipal elections.

Ontario’s conclusion based on federal and provincial evidence:

Most jurisdictions have concerns with the security of voting over the internet as technology and legislative frameworks have not yet evolved to fully address integrity concerns.

When examining the US experience, Ontario finds particular importance in independent public audits:

First, we will need to extensively test any proposed solution to ensure that it meets our implementation criteria. When conducting these tests, we should consider the value of offering independent, public review and open testing to ensure that Ontarians can be satisfied that we have resolved any potential concerns regarding security, privacy, authentication, and verification.

The report then turns to the 2003 and 2007 Internet voting trials in the UK. For the large trial in 2003 it finds:

Overall, although electors enjoyed the convenience of network voting, it had a very minimal affect on turnout. While some jurisdictions experienced voter turnout increases up to 5 per cent, other jurisdictions registered a decline in voter turnout of up to 8 per cent.xxviii

For 2007, the results were even worse:

In a review of the pilots, the United Kingdom Electoral Commission found there was insufficient time available to implement and plan the pilots, and the quality assurance and testing was undertaken too late and lacked sufficient depth. The United Kingdom Electoral Commission stated that “the level of implementation and security risk involved [with the pilots] was significant and unacceptable”.xxx

The end notes are
xxviiiUnited Kingdom Electoral Commission. 2005. Securing the Vote.
xxxUnited Kingdom Electoral Commission. 2007. “Key issues and conclusions: May 2007 electoral pilot schemes.”

See the references mentioned in the end notes in the copy of Appendix 3: Selected Works Consulted.

All that remains of the Securing the Vote report on the UK Electoral Commission site is the page Securing the vote – detailed proposals for electoral change announced.  The actual document itself does not show up in search.  The only location where a copy could be found was in a document repository from The Guardian newspaper: http://image.guardian.co.uk/sys-files/Politics/documents/2005/05/20/eleccommission.pdf

The UK did extensive reporting on the 2007 pilots, the website was http://www.electoralcommission.org.uk/elections/pilots/May2007 but it is no longer online.  There is a copy in the Internet Archive.

Although there is no longer an organising page on the Electoral Commission page, some of the reports from 2007 are still available from them, as well as being copied in the Internet Archive.

There are two considerations to highlight from the UK Electronic Voting Summary:

  • New voting methods should be rolled out only once their security and reliability have been fully tested and proven and they can command wide public confidence.
  • The necessary costs for secure and reliable systems must be able to be reasonably met by the public purse.

I will highlight only one item from the Technical Assessments of the e-voting Pilots, item 3.4.4 from Assessment of the pilot process – Quality management:

While there were variations between the different pilots, in all cases the quality and testing arrangements appeared to be inadequate. It is difficult to tell whether this was purely because of lack of time, or whether some of the suppliers were not used to implementing effective quality processes. Significant quality management failings include:
a. Lack of detailed design documentation;
b. Lack of evidence of design or code reviews or other mechanisms for ensuring that the solutions operate correctly and do not include deliberate or accidental security flaws;
c. Lack of evidence of effective configuration management.

This kind of haphazard voting software development has been shockingly common, e.g. for US voting machines as well.

Returning to the Province of Ontario report, moving on to conclusions, the key point that Internet voting does not increase turnout is again emphasized

As we discussed earlier in this report, often people assume that introducing a new channel of voting such as network voting will translate to an increase in voter turnout. Our research supports the findings of the City of Edmonton’s Issues Guide on Internet Voting which states that, at present, there is

“no conclusive evidence that shows introducing Internet voting will have a positive impact on turnout. Internet voting will not fix the problem of voter turnout decline completely –it is not a solution to the social and political causes of non-voting. ….”xxxiii

The end note is

xxxiiiGoodman Issues Guide: Internet Voting. p. 20.

This is a reference to Edmonton’s Issues Guide: Internet Voting by Nicole Goodman, November 2012.  Currently available from the City of Edmonton, and also in the Internet Archive.

To quote the Issues Guide:

The rationale(s) for not adopting Internet voting or for being more cautious in its consideration include topics such as security, notably threats of hacking and election fraud and problems associated with voter authentication. Privacy/ ballot secrecy is also cited as a worry. Additionally, there is uncertainty surrounding an effective evaluation process such as the ability to audit the election that may include a re-count or some type of ballot verification.

See the references mentioned in the end notes below in the copy of Appendix 3: Selected Works Consulted.

Moving to Appendix 5: Network Voting Business Case

Alternative Voting Technologies Report – Appendix 5 Network Voting Business Case (2012).pdf – copy in Internet Archive

I will quote only the section on chain of trust, just to illustrate the complexity of properly building an Internet voting system, followed with some commentary:

If the implementation of the network voting system does not both support the Chain of Trust and provide auditable evidence, then the process is open to question. This Chain of Trust is a compilation of all the following measures:

  1. Source code audit to verify that the code will do only what it is intended to do.
  2. Digital signature of the audited source code to protect its authenticity and integrity.
  3. Trusted build of the executable code in front of auditors (based on audited source code).
  4. Signature of the executable code to protect its authenticity and integrity.
  5. Deployment of the executable software in a clean system. Logical sealing of the system to detect any later additions.
  6. Logic and accuracy testing of the voting system to validate it works properly.
  7. Continuous audit of the voting system during the election, through review and validation of logs and other data. The logs must be protected from external manipulations by using cryptographic measures.
  8. Post-election audit that validates that the system behaved correctly by reviewing the logical seals and the protected logs.
  9. Individual voter verification that proves their ballots were used in the final tally (by using special receipts).

A strong emphasis must be placed on audit. Independent auditors must be able to review the source code, verify the build and deployment, audit system logs during the election event, and finally to review both the counting process and the results.

So this sounds reasonable, if challenging, time-consuming, and expensive, plus requiring a great deal of specialised expertise (which means excluding most oversight by ordinary citizens). But when examined from a computer science perspective, it might as well be called “the insurmountable mountain chain of trust“, because each step indicated above is a difficult problem in and of itself, and some of them are active areas of research because they are currently unsolved.  Doing a meaningful source code audit for any non-trivial source code is incredibly challenging.  Making a “trusted build” is almost impossible, because literally every software component in the build needs to be somehow trusted.  Needing trusted software components means a logical loop that can’t be satisfied: in order to build trusted software, you need a trusted compiler, but in order to build a trusted compiler, you need a trusted compiler.  Similarly, the concept of “logical seals” sounds great, but no such thing exists.  You might as well say “magic lock”.  This is just one of the reasons why computer scientists will tell you that secure Internet voting with trusted software is a problem that isn’t currently solved.

Finally, here are the works cited by the main report. Where necessary, I have added Internet Archive links for unavailable works.

APPENDIX 3 – SELECTED WORKS CONSULTED